The Ransomware Demand and the Undisclosed 2023 Incident
Corvus Billing Solutions processes claims for 1,100 provider clients and holds 42,000 patient records. On a Tuesday it discovers ransomware: records were exfiltrated and a demand for $180,000 in Bitcoin is posted with a 96-hour clock. The insured has already engaged an incident-response firm for $40,000 - not on the carrier's panel - and notified you on day 9. The cyber policy carries a $1M aggregate limit, a $250,000 ransom/extortion sublimit, a $50,000 deductible, a mandatory pre-approval requirement for panel counsel, and a retroactive date of 1/1/2022. The application asked whether the insured had experienced any ransomware or extortion incident in the past three years; it answered no. Your file notes show a 2023 incident the insured resolved for $12,000 out of pocket without notifying anyone.
1. The CFO wants to know today what the policy will pay and what you need from them first. Outline your coverage response and required next steps.
Read the worked answer
First, control the clock and the record. Issue a written reservation of rights rather than an oral opinion - the facts are still moving and three coverage issues are already live (late notice, non-panel IR costs, undisclosed prior incident).
Payable, subject to investigation:
- Ransom payment up to the $250,000 sublimit, not the full $1M - the sublimit caps the category regardless of aggregate remaining. The $50,000 deductible applies to the loss as a whole per the policy's deductible provision; confirm whether it sits inside or outside the sublimit before quoting a net number.
- Forensics, breach notification, credit monitoring, and regulatory defense - typically the core of a cyber grant, and where the real cost here lives given 42,000 records. Notification duties are deadline-driven (HIPAA generally 60 days from discovery; state statutes vary and several are shorter), so fund notification now even under a reservation.
- Business interruption only if the policy grants it and only for the documented outage period; obtain the restoration timeline.
Likely not payable absent agreement: the $40,000 already spent with a non-panel firm, because pre-approval is a condition. Do not refuse outright - ask whether the panel firm can ratify or adopt the work, which preserves goodwill and often recovers most of the value.
Next steps to demand in writing: the incident timeline and first-notice date; the ransom wallet address for sanctions screening; the IR firm's scope and invoice; a preservation demand; and a sworn statement on the 2023 event.
2. How do you handle the 2023 incident that was not disclosed on the application?
Read the worked answer
Treat it as a coverage question and a fraud-indication question separately, and do not let one contaminate the other.
Materiality analysis first. A single $12,000 self-funded event, fully resolved, may not be material to an underwriter's decision on a $1M cyber program - many carriers would have issued the same policy with a higher retention or a ransomware sublimit. That is the key question: would the underwriter have written this policy differently? Get the underwriter's declaration in writing, contemporaneously. If the answer is 'no change,' rescission is not supportable and the honest course is to note the misrepresentation, keep the ROR on other grounds, and move on.
If the underwriter says the answer would have changed (declined, or materially different terms), you have grounds to rescind or reform. Even then, most jurisdictions require return of premium, and rescission on a claim that is otherwise covered invites litigation that will cost more than the exposure. Weigh rescission against a negotiated resolution - a higher retention, a ransomware sublimit endorsement, or a coverage release.
What not to do: do not use the misrepresentation as leverage to underpay an unrelated covered component (notification costs) without stating the basis. That is the fact pattern plaintiffs' counsel builds bad-faith claims on.
Documentation: record the underwriter referral, the materiality conclusion, and the reasoning in the file. Refer to SIU for a fraud-indication review but keep the coverage decision independent of the SIU outcome.
3. The insured calls wanting approval to pay the ransom in 24 hours. What is your decision process?
Read the worked answer
Screen before you approve - this is not optional and it is time-critical in both directions.
- Sanctions and AML screening. Run the wallet address and any named threat actor through sanctions screening (OFAC SDN and equivalent lists). Paying a designated person or entity, or facilitating such a payment, can expose the carrier and the insured to serious civil and criminal exposure; several jurisdictions also have their own regimes. If the address resolves to a sanctioned actor, the answer is a documented decline on that basis, not a business judgment. Insureds frequently do not know this and will pay anyway - put the warning in writing.
- Decryption reality check. Ask the IR firm for a probability-of-decryption assessment and whether backups restore. Ransom paid for keys that do not work, without a decryptor test, is a pure loss.
- Extortion economics. Confirm no second-stage demand is being telegraphed; double extortion (exfiltration plus publication) changes the loss profile from recovery to notification and reputational cost.
- Approval mechanics. Confirm the sublimit, apply the deductible, and document the approved amount and payee in advance of payment. Many policies require carrier consent to pay; an unauthorized payment can be unrecoverable even where the loss is otherwise covered.
- Record the decision and the reasons - including that you screened, what the screen returned, and who approved.
Ethically, the adjuster's job is not to moralize about payment but to make sure the insured's decision is informed and lawful. That means stating the sanctions risk, the decryption risk, and the notification obligation even if the ransom is paid.